2

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level security (HTTPS over the public internet) and for message level signing and encryption in the SOAP payloads.

Is this typically considered bad practice? The immediate downside that comes to mind is the fact the key now exists in more than one place and is a little more vulnerable than if it was in one place. Compromising the key would break both the HTTPS and SOAP level security. Are there more issues to be aware of here? How is this handled in other places?

Improve this question
1
  • I don't see any immediate red flags inherent to using the same certificate in more than one place. On the surface, that doesn't seem too different from getting a wildcard HTTPS cert and using it on multiple webservers. Though I'm sure someone smarter than me will point out something.
    – Mike Ounsworth
    Commented Nov 16, 2018 at 1:31

1 Answer 1

Reset to default
1

Ok so without wanting to answer with "depends", here's my thoughts on this.

Signing the SOAP messages with a certificate provides the ability for legal non-repudiation of the message contents.

You're right that having the same cert used means that you're potentially over exposing the key.

So this is where the "depends" comes in.

If your use case is to provide assurance that the message is being sent, unchanged, by who it's signed by, then you're doing this wrong, and you should use separate certs and treat them properly.

If your use case is more to simply verify that the message body has not been tampered with in general and that it's been signed by something that has access to this shared private key, then I'd be ok with it personally.

Cheers, Pete

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .